Slashdot Mirror

← Back to Stories (view on slashdot.org)

Contactless Credit Cards

Posted by ryuzaki0 on from the don't-crowd-me-in-line dept.

An anonymous reader writes "According to his article in EETimes, Visa and Philips are teaming up to introduce a so-called "contactless credit card". Basically it'll work like the proximity cards many of us use for access to our places of work or apartments. You won't need to physically swipe it, simply waving it over a reader is good enough."

91 of 414 comments (clear)

  1. Good and badGood and badGood and Bad by krray · · Score: 5, Insightful

    I like the convenience idea of it. The magnetic strip in my credit cards are usually destroyed/useless before the card even expires. Between rubbing against other credit cards, contact with the leather, and/or body sweat highly used cards are usually replaced before they ?expire?.

    Where?s the security? I often wonder why the heck credit card purchases don?t require a PIN at the very least. Yeah, we?re all high tech and thumb prints and/or eye scans would be cool, but I?m all for having to know and enter a PIN on each and every purchase.

    I tend to go for EFT payment whenever possible as I do have to enter a PIN. Shoulder surfing or a corrupt security camera guy is always a problem. I?m smart enough to remember a purchase PIN and a ATM/Cash type transaction PIN too. I suppose insurance costs and ?shrink? just isn?t too expensive yet?

    I?d be impressed if there was a thumb reader built into each plastic card I waived around buying all my shit.

    Mobile gas anyone?

    1. Re:Good and badGood and badGood and Bad by the_bahua · · Score: 5, Insightful

      I would be interested to know how they would be able to stop "contactless thieves" in this case. It seems to me that scanners would become available for people to walk around zapping people's funds away from them. One nice thing about the tried and true swipecards is that to charge them, it's very much a physical action.

      At the very least, the signature process should be retained.

    2. Re:Good and badGood and badGood and Bad by FatRatBastard · · Score: 5, Interesting

      Hell, there's even a simpler problem: If I have more than one credit card which one will it "charge?" Or will it charge both?

    3. Re:Good and badGood and badGood and Bad by FatRatBastard · · Score: 2, Interesting

      ...Assuming you're a lazy ass like me and don't take it out of your wallet when you swipe it to get into your building.

    4. Re:Good and badGood and badGood and Bad by pirodude · · Score: 3, Insightful

      It's fairly easy and a part of all smartcards on the market today. Not only is the reader able to verify the card, but the card is able to verify the reader.

      How I see it working would be, 1 central authority (CA like we know it for SSL certs) issuing certificates to all of the readers on the market (there still needs to be a way to expire the certs incase one gets stolen, put out of service). The cards will contain the corresponding certificate for the CA so it can properly validate any certificates the CA signs. When

    5. Re:Good and badGood and badGood and Bad by teknokracy · · Score: 5, Insightful

      And then it comes down to the point where you have the fact that the card could just as easily be stolen. No amount of encryption would protect a card from that.

    6. Re:Good and badGood and badGood and Bad by RajivSLK · · Score: 4, Interesting

      to charge them, it's very much a physical action.

      Physical, hardly.
      Have you ever purchased anything online?

      All I need is your number, name and expiry and I can charge your account all I want.

      Credit card accounts are inherently very insecure. Prosecution is the only thing stopping (even more) massive fraud.

    7. Re:Good and badGood and badGood and Bad by b0r1s · · Score: 5, Informative


      I would be interested to know how they would be able to stop "contactless thieves" in this case. It seems to me that scanners would become available for people to walk around zapping people's funds away from them. One nice thing about the tried and true swipecards is that to charge them, it's very much a physical action.

      Not entirely true. One of the more common credit card scams here in Los Angeles is portable card scanners being carried by waiters in restaurants. As they take the card you've handed them back to scan it for the bill, they scan it in their personal scanner, which records the information for later use.

      There is no meaningful physical location tied to this because you've given your card (intentionally) to someone you have to trust. If you eat at multiple restaurants over the course of a week, there's no easy way to trace the theft back to an individual location.

      --
      Mooniacs for iOS and Android
    8. Re:Good and badGood and badGood and Bad by Jetson · · Score: 5, Informative
      The magnetic strip in my credit cards are usually destroyed/useless before the card even expires.

      My cards usually crack from curvature long before the stripe is demagnetized or worn away. I guess that's what comes from sitting on your wallet all the time.

      FWIW, Esso Canada (gas station chain) has been using keychain-dongles for rapid payment for about a year now. You just hold your keys in front of the coloured box on the pump for a few seconds and it prepares to make the sale exactly the way it would if you stuck your card in the stripe reader. They also put the same dongle-reader at each cash register so you can buy your morning coffee a few seconds faster....

    9. Re:Good and badGood and badGood and Bad by KrispyKringle · · Score: 3, Insightful
      "Skimmers" are pretty common as is. If we had a more complex system to defeat them involving some sort of PKI you have two issues.

      First, this would be hardware based and it'd be fairly likely that someone out there would sell a legit signed reader to a theif or a theif would get one somehow. Unlike the CA analogy, where this only effects people if the fake store manages to steal the real store's private key as well and the weak point of trust is still a legitimate store, here, we are looking at a stolen card reader and suddenly the weak point in the chain is not just a shopkeeper or retailer, but any random theif who manages to walk by you on the street.

      Second, how would this infrastructure work in conjunction with CC# purchases where there is no physical transaction, i.e. online purchases? I suppose you could only implement it for proximity card purchases, some sort of built in smart-card feature as you said, but I don't even see it as providing that much security. As I said, one stolen reader and someone can charge you whatever they like.

      The best solution I can come up with, now that I think about it, is to have all the proximity-broadcast information encrypted with a public key for VISA or whoever, and only VISA can decrypt it. That way, even a stolen reader is useless, all someone can do is charge for purchases, and then the money paid from the CC company is traceable anyway. There is no way for the theif to actually gain the CC details. No need for any other sort of security; you could give this information out to everyone on the planet and have it still be totally secure.

    10. Re:Good and badGood and badGood and Bad by cmallinson · · Score: 2, Informative
      Hell, there's even a simpler problem: If I have more than one credit card which one will it "charge?" Or will it charge both?

      I have two proximity cards on me at all times, for two different security systems. Whenever I swipe one card, and the other is too close, it will not work. There seems to be some interferance between the two cards. I assume that the reader machines would be able to tell if more than one card is detected, and the transaction would fail.

    11. Re:Good and badGood and badGood and Bad by nmg196 · · Score: 2, Insightful

      > Physical, hardly.
      > Have you ever purchased anything online?

      Yes, I seem to recall needing to physically see my card to do it and enter the numbers on a keyboard. The site did not simply sense the card in my wallet from a pop-up window and start charging things to it.

      > All I need is your number, name and expiry and I can charge
      > your account all I want.

      And how will you get those without seeing something with my card details on it (like my card)?

      The argument here is that just walking past something/someone carrying a proximity reader could steal all the details off your card and possibly start using it unless it's also combined with some kind of compulsory PIN.

      Nick...

    12. Re:Good and badGood and badGood and Bad by RajivSLK · · Score: 3, Interesting

      My point is that the current credit card authentication system is so insecure that it doesn't really matter what the physical card is made of. The only thing that keeps massive fraud from occurring is the paper trail. It is easier to trace the money and prosecute that it is to secure the system. Securing the system would inconvenience the user and that is something that visa would never want. It is much easier to prosecute.

      That being said we may see this attitude change in the future as online credit card databases allow fraud on a much larger scale.

      For the record I can get a large number of credit cards (probably yours too) fairly easily:

      Receipts carelessly tossed in a garbage can outside of certain stores (yes, many of them do print your full name, card number and exp. Date)

      Hacking insecure online servers (many have 1000s of cards in plain text or weakly encrypted)

      Grab your mail

      Look in your recycling box

      Look at your card over your shoulder

      Hidden cameras, crooked cashiers/waiters etc

      Set up a fake online store selling a few products very cheaply.

      Set up a cheap porn site. (ala the Eros Island scam)

      etc

    13. Re:Good and badGood and badGood and Bad by jdreed1024 · · Score: 4, Informative
      All I need is your number, name and expiry and I can charge your account all I want.

      Actually, that's less and less the case. With the exception of the "big" vendors who have enough fraud insurance (amazon, etc), more and more vendors are instituting stiff requirements on your card purchases such as: a) shipping only to the credit card billing address (or another address listed on your credit card), b) requiring that you enter the CCV (the three digit number printed on the signature stripe of the card), c) requiring that you enter your credit card's customer service number so they can contact your bank.

      And almost all online vendors (except the really sketchy ones) require that you provide the credit card billing address when placing an order. If they don't match, the order won't go through. I have had several vendors call me when this happened because I typo'd the name of my street.

      On a related note, I wish more and more brick and mortar stores would check your signature. To prove a point, my friend and I were making a purchase at a large national chain store, and he signed "Homer J Simpson" to the credit card receipt, and the cashier didn't care.

      --
      There is no sig, there is only Zuul.
    14. Re:Good and badGood and badGood and Bad by jdreed1024 · · Score: 4, Informative
      I like the convenience idea of it. The magnetic strip in my credit cards are usually destroyed/useless before the card even expires. Between rubbing against other credit cards, contact with the leather, and/or body sweat highly used cards are usually replaced before they ?expire?.

      The mag stripe isn't actually necessary for making the purchase. (If a store salesdroid tells you it is, demand to see the manager or take your business elsewhere). Only the card itself is required.

      Back in the day, credit cards didn't have mag stripes. They were called charger plates, and they were placed in a machine along with a carbon sales slip, and when a roller was moved back and forth across the paper, an imprint of the card was made on the sales slip. And you signed it to charge something to your MasterCharge or BankAmericard.

      The security was in actually having the card present at the checkout. That is still the case - you swipe it to prove that its there, or if the stripe doesn't work, they take an imprint of it (all places that take cards are supposed to have an imprint machine). That, combined with the signature, is in theory enough security. I'd wager a large portion of credit card fraud could be stopped if places would stop hiring illiterate 12 year olds at registers who can't even read, let alone compare signatures.

      --
      There is no sig, there is only Zuul.
    15. Re:Good and badGood and badGood and Bad by thelexx · · Score: 4, Insightful

      Card in pocket, it is far from "just as easy" to take it from me as it would be to pass a wand over my butt without me noticing.

      --
      "Gold still represents the ultimate form of payment in the world." - Alan Greenspan, 1999
    16. Re:Good and badGood and badGood and Bad by damiangerous · · Score: 2, Informative

      "See ID" is consider invalid. The merchant is not allowed to accept any card with "See ID" written on it. They're supposed to make you sign the card and then compare that signature with another piece of signed identification. If you refuse to sign the card, they're not allowed to accept it. They usually do, of course, due to poor training or apathetic cashiers, but they're completely liable for any chargebacks in that case.

    17. Re:Good and badGood and badGood and Bad by anthony_dipierro · · Score: 3, Informative

      I'd wager a large portion of credit card fraud could be stopped if places would stop hiring illiterate 12 year olds at registers who can't even read, let alone compare signatures.

      Of course, hiring anyone but illiterate 12 year olds at registers would cost more than the credit card fraud they'd stop.

    18. Re:Good and badGood and badGood and Bad by archaic0 · · Score: 2, Interesting

      The whole idea of using the signature to validate the purchase is stupid if you ask me. Let's step through the process.

      step 1: bad guy steals my card
      step 2: bad guy goes to store
      step 3: bad guy grabs a $1000 worth of stuff
      step 4: clerk rings it up and swipes my card
      step 5: CARD CLEARS - money gone
      step 6: bad guy signs name
      step 7: clerk then compares signatures
      step 8: they're close, or could be close, but he doesn't really know because he's not an FBI handwriting expert. So what the heck does he do? He assumes it's OK. Then it's up to me to figure out what went wrong, PROVE IT, and fight for my money back. It will eventually come down to comparing signatures and will all be fixed.

      Even if the clerk does think the signature is bad enough that it might be a bad guy, he can hold the card, but the stuff and the bad guy go right out the door. Then, let's start the process of getting my money back. Meanwhile, I'm out $1000

      Say it is me with my own card, but I've had a bad day and I have a cold and my signature looks nothing like it did when I signed the card. Then what?

      Signature comparing equals zero security. Only if a handwriting expert was the clerk would it be anywhere close to making sense.

      All cards should require PINS and/or require photo ID. No exceptions. Online purchases should be governed by a list of changing PINS that your bank gives you via ATM reciepts or monthly bank statements. You'd have to remember the next two PINS maybe each day, but I'd rather do that than deal with fraud. Or we could go to biometrics, but I think we're closer to the PIN solution than refiting all the terminals with scanners.

      --
      [ http://www.dvigroup.net/self ] ...where I keep my pennies and nickels...
    19. Re:Good and badGood and badGood and Bad by Zirnike · · Score: 4, Interesting
      "I wish more and more brick and mortar stores would check your signature"

      I used to work for Sears. I did this. One guy comes up, tried to buy something, I think a faucet, and gave me an unsigned credit card. I asked him for ID, he gave it to me, complaining, and I handed back the ID and the card, and asked him to sign it. He refused, started yelling, and walked out.

      Mind you, the card quite clearly states 'not valid until signed'. And this wasn't an isolated incident, either.

      That is why stores don't check signatures very well. Customers don't want the security it provides.

      --
      I'm not shy, I'm stalking my prey
  2. Contactless? Great! by Anonymous Coward · · Score: 5, Funny

    They won't know where to send the bill!

  3. Pickpocket from a distance... by bgog · · Score: 5, Interesting

    Let's see. A crowded line at an amusement park... I'm sure I could pick up 100 credit card numbers an hour with my wiz-bang pocket card reader. "Excuse me sir... I didn't mean to bump into you..."

  4. Anyone taking bets... by Verteiron · · Score: 2, Insightful

    ... on how long it takes before someone cracks/hacks whatever security these things have and begins making megabucks by planting remote cardreaders in places like mall store entrances?

    How long will it be? Say, to the nearest hour or so?

    --
    End of lesson. You may press the button.
    1. Re:Anyone taking bets... by RodgerDodger · · Score: 2, Insightful

      I would hope that it would require more than simply waving it around. At the least, I would like to see, say, a button on the card you have to press at the same time.

      Otherwise, as you say, someone will come up with something to read them for sufficent distance to go through clothing, your wallet, etc, without you knowing. Sure, the range (according to the article) is only 20 cms, but even that's too far for my peace of mind.

      --
      "Software is too expensive to build cheaply"
    2. Re:Anyone taking bets... by cruppel · · Score: 4, Informative
      ...I would like to see, say, a button on the card you have to press at the same time.

      I had the pleasure of seeing a prototype credit card that had that feature. It was geared toward online purchases and basically worked like this:

      1. You had to have a small signal receptor at the time...this was over three years ago and they were trying to get rid of that piece of equipment.
      2. When you enter your card info on a website, instead of typing it, you press an area on the card, and it emits a sonic signal that tells the receptor that
        1. You've actually got the card and
        2. It's you using it. The info (name, billing address, etc) is all in the card.
      4. To prevent someone from stealing your card and using it at their convenience you needed to enter a PIN once you pressed the button to make it work. In the end it auto-filled your forms for you, and I thought as a concept it looked promising.

      The button is an excellent idea because you save transmitter life, although I'm sure there's a power supply that can live the life of a credit card. It also controls when the info is sent out. I wouldn't mind throwing a PIN on there either. Hell, I don't even have a credit card, just a check card, so I'm fine with PINs

      Damn I like ordered lists!

    3. Re:Anyone taking bets... by ColaMan · · Score: 4, Informative

      Most of the proximity cards are powered by the RF field that is used to interrogate it.

      Still , a button would be nice. Even just a 'squeeze point' (eg squeeze the card whilst waving over reader) would be handy.

      Then we could also have the obligatory "Squeeze the last cent out of my card jokes"

      --

      You are in a twisty maze of processor lines, all alike.
      There is a lot of hype here.
  5. Go for it by TopShelf · · Score: 4, Insightful

    The nice thing from a security standpoint is that the credit card companies have it in their own best interest to make sure people feel confident using these new technologies. While a single cardholder could be at risk to lose a few thousand dollars, these companies have billions riding on these transactions. When it comes to secure computing, this is one industry that actually keeps it on the front burner...

    --
    Stop by my site where I write about ERP systems & more
    1. Re:Go for it by berzerke · · Score: 4, Informative

      ...When it comes to secure computing, this is one industry that actually keeps it on the front burner...



      I beg to differ. Credit card fraud runs in the billions of $ every year. One article claims the losses will be about (2002 figures) "$285 million over the holiday season in the United States." And that's just about 1 month's worth. Credit cards are anything but secure. Since consumers don't see the cost of the fraud directly, most are barely aware it exists. Of course, the cost is passed on in the form of higher fees and interest.



      Merchants (and their employees) don't help matters any either. On all my cards, in the signature block, I put "Please ask for ID". (I've checked with Discover and they have no problems with that, BTW). Rarely do I get asked for ID.



      Then there are merchants, such as the USPS, which won't accept the card without an actual signature. Don't need to show ID (I tested this), but it must have a signature or they won't accept it. It's an actual federal rule (I checked), so the clerk isn't doing anything wrong. Maybe it's just me, but I would trust a driver's license MORE than a signature with nothing to compare it too.

    2. Re:Go for it by Talez · · Score: 2, Insightful

      Maybe it's just me, but I would trust a driver's license MORE than a signature with nothing to compare it too.

      You mean all this time I couldn't compare the signature on the receipt to the signature on the back of the card?

      Holy shit... I must be responsible for millions in credit card fraud alone.

    3. Re:Go for it by mrscorpio · · Score: 2, Insightful

      I'm sorry, but the "check ID" thing in the signature is so stupid (I used to work retail so I had many incidents and much idle time for this thought to occur). All someone has to do, if they steal your credit card, is to make a fake ID with their picture and your name on it. Fake ID's are much easier to obtain than signatures are to copy, and cleaning the signatures off and replacing them doesn't really work very well anymore...and if it did, they could just wipe off "check ID" and write your name in their handwriting anyway.

      Do you see your folly now?

      Chris

    4. Re:Go for it by berzerke · · Score: 2, Interesting

      ...Fake ID's are much easier to obtain than signatures are to copy...



      True. However, if fake ID's (such as driver's license) were sooo easy to get, they would be worthless as ID's. Yet, they are accepted as such almost everywhere. Strange. Hmmm...



      Now, how many people are handwriting experts and would be able to make a meaningful comparison (assuming they even tried)? In any case, a handwriting sample is available to compare to (the "Please ask for ID" - ask me to write that if you want the same phrase.) And oh yes, my signature is on my driver's license, so there you have another thing to check against.



  6. Perfect business opportunity by Anonymous Coward · · Score: 5, Funny

    Shielded wallets/credit card holders. Someone call ThinkGeek.

    1. Re:Perfect business opportunity by GimmeFuel · · Score: 4, Funny
      You're behing the times, man. Us early adopters have had tinfoil-shielded wallets for years. Don't you know the government has spy satellites that can read the magnetic stripe on your credit card and track you whereever you go?

      /me climbs into tinfoil bodysuit and runs for protection in underground tinfoil bomb shelter

      --
      live(free) || die;
    2. Re:Perfect business opportunity by GnarlyNome · · Score: 5, Funny

      How about the RFID tag in the tinfoil?

      --
      Diplomacy is the art of saying "Nice doggie" until you can find a rock. Will Rogers
    3. Re:Perfect business opportunity by kurosawdust · · Score: 2, Funny
      /me climbs into tinfoil bodysuit and runs for protection in underground tinfoil bomb shelter

      How much protection do you need from tinfoil bombs?

    4. Re:Perfect business opportunity by Odin's+Raven · · Score: 2, Funny
      How about the RFID tag in the tinfoil?

      Just do what I do, and destroy the RFID tag by microwaving all your tinfoil first.

      (whooop whooop whooop)

      Ooops, gotta run -- damned microwave's set off the fire alarm again...

      --
      A marriage is always made up of two people who are prepared to swear that only the other one snores.
  7. Mastercard beat them to it by sunilonline · · Score: 2, Informative

    http://www.paypass.com/ Currently beta testing in Florida...

  8. Sounds an awful lot like SpeedPass by Otterley · · Score: 4, Insightful

    This sounds an awful lot like SpeedPass, which is at least 5 years old. Any idea what the difference is?

    1. Re:Sounds an awful lot like SpeedPass by bgog · · Score: 3, Informative

      Uhhh.. Visa is doing it. Which means if it actually happens, it'll be accepted at MANY more locations than speedpass. Additionally with a decent amount of storage and the high bit rates, you could use one card to buy stuff, get into your gym etc.

  9. Why by I+don't+want+to+spen · · Score: 3, Interesting

    Other than the magnetic strip not wearing out, what's the advantage? Unless its short-range enough that passers-by can't steal your money, you'll still have to present it to a reader (the article mentions 20cm) Or perhaps they mean it can't be swiped (as in stolen.) It could mean the end of shoplifting though, just use the security scanners to read the RF tags in what has been taken and then take the money straight off the card. (Actually, that could be a great way to shop: pick things off the shelf, walk out and pay without having any queues at the checkout. Where's my patent lawyer?)

    --
    Don't go to a brothel if you want to buy broth
    1. Re:Why by mnewton32 · · Score: 3, Funny

      Actually, that could be a great way to shop: pick things off the shelf, walk out and pay without having any queues at the checkout. Where's my patent lawyer? You could try, but I'm sure Amazon would sue you. "Buying something? Don't we have a patent for that?"

    2. Re:Why by thirdrock · · Score: 5, Interesting

      Other than the magnetic strip not wearing out, what's the advantage?

      When I lived in Hong Kong there was a smart card (not Credit Card) called Octopus. Basically, you buy the smart-card, you add cash funds to it, and then you can use it to ride the train system.

      It was incredibly convenient, not to have to buy tickets, and much greater throughput than ticket machines. You just walked through the gate and swiped your wallet over the reader.

      Anyways, it wasn't long before they figured out the advantage of converting the vending machines in the station over to Octopus. No cash to collect, just fill it up with product and collect the money from the Octopus administrators, less administrative fee.

      I can tell you from experience, it beats the hell out of coins, changing money, messing about with cash, fumbling about with change. Just swipe your card and get your product. Faster, easier and much more effecient.

      Best of all, the cards were anonymous, which means the govt couldn't track you via the card. Disadvantage of course is that if the card was lost or stolen, there was no recovery. I guess for that reason the maximum you could put on the card was HK$500.

      To me this was the first step towards an anonymous cashless society, which despite the Orwellian protests of the tin-foilers, is IMO, A Good Thing(tm). Money spreads disease, has an administrative cost, is vunerable to forgery. If we can have all the advantages of cash, including anonymity, then I say, let's get rid of cash.

      --
      >>
      I am the director, and this is my movie ...
    3. Re:Why by Fastolfe · · Score: 2, Informative

      These are pretty basic questions that have already been figured out. A quick Google search brings up this little FAQ that you might find interesting: http://ntrg.cs.tcd.ie/mepeirce/Project/Mlists/mini faq.html

  10. Yanno what I'm thinking... by Julian+Morrison · · Score: 4, Funny

    so THAT's why the Jedi Hand Wave works.

    "These are not the droids you're looking for"
    (handwave, subtle ka-ching! sound)
    "These are not the droids I'm looking for.. move along..."

    1. Re:Yanno what I'm thinking... by space_biker · · Score: 4, Funny

      Didn't work for Qui-Gon in episode 1...Must have been in beta then?

  11. Mobil Speedpass by tbdean · · Score: 5, Interesting

    That's how I pay for gas at Mobil, with their Speedpass. It's a small keychain thing that looks like a black magot:

    Well, that was how I paid for gas at Mobil. I cut my Speedpass open, took out the glass cylinder, and put it inside my Nextel i90 cell phone, it fit next to the battery. The Speedpass only lasted a few months before dieing. I haven't tried it again yet...

    It was cool when it worked though, I just held my cell phone up to the pump to pay for gas.

    --
    tbdean
  12. Contactless credit cards? by cperciva · · Score: 5, Funny

    I've been using a contactless credit card for years. I type the number into an HTML form, and my card never comes within the same city as the merchant I'm purchasing something from. For that matter, it sometimes isn't in the same city as I am when I'm making the purchase -- for a couple months last year it was on a different continent.

    In fact... let me see here... no, I still haven't gotten around to signing the back.

    --
    Tarsnap: Online backups for the truly paranoid
  13. Absolute Fascist Control by HotNeedleOfInquiry · · Score: 4, Insightful

    Read the article. Plenty of subtle reference to rights management and content control. Buy a DVD with this viper and have to wave it next to your DVD player to get it to play.

    --
    "Eve of Destruction", it's not just for old hippies anymore...
  14. Re:BAD IDEA by Anonymous Coward · · Score: 3, Funny

    A hot chick rubbing your ass would be a sure sign something was wrong to any Slashdot reader.

  15. Let me get this straight... by djupedal · · Score: 4, Funny

    You say you are smart enough to remember a purchase PIN and a ATM/Cash type transaction PIN, yet you also claim to be buying shit?

    Most, if not all, of the smart people I know never, ever 'buy' shit....they seem to find a way where people continously give them shit, sometimes for no apparent reason. Now I know some would argue that this may well be a gift, but I've watched this happen, over and over, and I'm here to tell you, it seems like it doesn't matter what they do or what they say, someone will eventually give them shit. Really! I am not kidding! It's true!!

    If you are having to pay for shit, may I suggest a crash course in shit 'taking'...you can sign up for one online I believe..perhaps right here, if you ask nice.

  16. My 2 yen by DNS-and-BIND · · Score: 3, Interesting

    Not to be a twit, but I heard about this sort of "keep it in your pocket" magnetic technology being deployed already. Around February of this year, one of my English students in Tokyo, who worked for Sony/Ericsson, told me his company's "secret" new cell phone in development would have this mag card tech built in. It would replace the "Suica Card" existing tech, which is just a card you mash against the reader while keeping it in your wallet. The phone was due to hit the shelves in 6 months, which would be this August. Only in Japan, of course, which means it should be out in America around August 2005.

    --
    Shutting down free speech with violence isn't fighting fascism. It IS fascism!
  17. Maybe good Maybe not by emerrill · · Score: 2, Informative

    The technology in general can be a great convience, I have used them before and it means you don't have to fish the card in and out of your wallet, but what happens when you have more then one of this type of card in your wallet (the reader will read them all properly, but which to use?) and theft is a real concern.

    Unless the also use a pin-number system, there is really nothing they can to to prevent theft. If you have a 'shielded wallet' or you have to press a button, then it defeats much of the point, and you have to actually get the card out.

    I'm worried that they will try a type of encryption, (info on card is encrypted, and the CC co has the key in a central data base). Now if they were to do a new encryption key for each card, then great, but I could see them using one key for all of them, then what happens if that key is leaked. Even if they do that, it keeps the CC number safe so it cant be used online or such (assumming that the RFID number is even related to the actual CC number, which it probalby wouldn't be) it still cant stop someone from making a new RFID card to retransmit the info.

    Basicly it all boils down to that there is no real way for the CC company to protect the card if it is contactless. with 20cm (about 8in) you could easilly walk around a mall with a reader in your pocket picking up the ids of the cards.

  18. Comments by proxy by NeoPotato · · Score: 5, Funny

    It's not a new concept. We already practice it here at Slashdot - we don't even have to read the article, we just get near the story and start spouting off comments.

  19. Re:too long range (maybe) by BakaMark · · Score: 2, Informative

    If you have 2 side by side, then there can be issues when trying to use them.

    This is something that I have seen with proximity cards for two seperate systems. When the two are together then when system A tries to contact Card A, Card B is also activated and the system cannot make any sense out of what it has received. Therefore no access.

    In this case you have to seperate the two cards, in order to read them.

    There has been talk about contactless smartcards for the past 10 years.

  20. Re:How easy would it be to steal info from these? by pirodude · · Score: 2

    It is very difficult to steal information from smart cards. I know of 1, maybe 2 ways to steal from smart cards that use contacts (one is to detect very small fluctuations in the voltage draw of the card as the crypto algorithms are doing their magic) and no ways to steal from contactless cards, given they are properly setup (and given Visa is backing it up, they probably are).

    You can set files on the card (it has a tiny file system) such that they can only be written to. I have a Cryptoflex 8k card here that has my public and private keypair on it for PGP. The public key can be read off very easily but for the private key to be useful, the card will actually do the encryption for me. So I will insert my card into the reader, I will type what I want to encrypt in my email window and when I press send it will send all of the text over to the smart card where it is encrypted with my private key, which never leaves the card. Now ideally you would run your keyboard right into the smart card reader for sensitive operations (so the host operating system cannot be backdoored and the plain text version ever recovered).

    The risks for these cards are very small. From what I can tell they'll probably be JavaCards (which basically will run a small java applet) that will only give up information about the card to verified readers (the card will store a certificate authority's public cert and verify the certificates of the readers) . This will stop the "stealing by walking behind someone with a reader" problem so many /.ers have complained about.

    Hope this helps (I've done a crapload of work with smartcards recently for a Purdue IEEE project)

  21. How you gonna.... by djupedal · · Score: 4, Funny

    You know, back when you could still afford to go out for dinner (DQ doesn't count), how the waitperson would bring the bill on a little plastic tray and lay it on the table....and you'd simply drop your c'card onto the bill...and then someone would take the tray and bill and c'card and....oh, wait, I get it...

    Hello, I'm Dwayne, I'll be your card waver this evening.

  22. First movers advantage and contentions? by toybuilder · · Score: 2, Insightful

    So, if Visa is the first mover, do they essentially "own" the wallet because the lazy consumer wouldn't want to bother pulling out a different card?

    And what happens if there are multiple cards that are contactless? Do I have to pick one out? What's the point of this, then?

    My building uses contactless badges. Ironically, we have a badge for the building and another for the garage. I can't keep both cards in the wallet because they interfere with each other.

    Finally, is Phillips proposing to make cars run off the card? Wow. Imagine starting your car just by sitting down...

    1. Re:First movers advantage and contentions? by kilonad · · Score: 2, Informative

      Wow. Imagine starting your car just by sitting down...

      You already can. Mercedes Benz, Porsche, and even certain Volkswagen models (just to name a few, I'm sure there's others) have this feature. You leave the keys in your pocket. To unlock the car, touch the door handle. To start the car, touch a button on the dashboard. To lock the car back up, just touch the outside door handle on your way out. The keys stay in your pocket the whole time. It works by actively seeking out your remote commander ("the clicker"), and if it finds it, it lets you in and lets you start it up. If it doesn't find it, or if it just plain fails to work, you can always take the remote out of your pocket and click. Or even... dare I say it, use the physical key itself. Anyway, it's pretty nifty stuff.

  23. These better have a small range by ebuck · · Score: 4, Funny

    These cards better have a small range (two feet max) or I don't see how you will manage to perserve the time-honored tradition of the grocery store line.

    "Did you swipe your card?"

    "Not yet."

    "That's funny, because your total has already been paid!"

  24. Pick-pocketing by dachshund · · Score: 4, Informative
    My work ID badge can operate through my wallet. In fact, I can often just touch my hip or coat pocket to the reader and the door will open, depending on how lazy I'm feeling.

    My concern would be that unscrupulous individuals would use portable readers to get your card number. It would be a form of pick-pocketing that wouldn't actually require any contact or much risk of getting caught.

    Hopefully, the cards would use some sort of challenge/response system, rather than a fixed number that could be replayed to a terminal. Still, there are bound to be vulnerabilities, and we'll probably be reading about them in a couple of years.

  25. Probably how they work by dzimmerm · · Score: 3, Interesting

    These kinds of cards do not usually have any kind of power source. They rely on a alternating current magnetic field that the reader gives off. This magnetic field energizes the coil that is built into the card. This coil supplies power to the circuitry on the card which causes the card to send its ID via some kind of rf signal. There are no "smarts in the card itself. The card just sends its ID and a computer behind the scenes uses that ID info to open the door or pay the bill.

    For those concerned about portable readers consider that a reader would have to send out a powering magnetic field and then capture the ID of the card. My guess is that all kinds of security could be built into these cards. The most obvious kind would be the use of an ID that contained a constantly changing code like the secure IDs many of us use to access various secured dialup and network devices. The only drawback is you would need some kind of contained power source in the card to power the secure ID ciruitry as it has to be constantly powered so it does not lose sychronization with the host system. My guess is the reader could still supply power for the RF signal while the secure ID part used a small lithium cell.

    That way the ID would not only have to be correct but the security code would only be good for about 3 minutes. That would make these things fairly secure, probably moreso than a card and a PIN as the PIN can be noted via cameras and the quicksighted.

    Physical theft of the card would be a problem but that would not be anything new to get used to.

    dzimmerm

    --
    Jumping to correct solutions slowly is better than jumping to incorrect solutions quickly.
  26. Challenge/response? by skraps · · Score: 2, Interesting

    I didn't RTFA, but here's an idea to counter some people's fear that a technology like this would necessarily allow you to steal card numbers as you walk through a crowd.

    The card could use a challenge/response system with the merchant. Each card has a symmetric key pair - the public key is your account number used for billing. The private key is known only to the card, and is used to sign a challenge phrase from the merchant. Challenge phrases would be unique to each transaction (given out by the financial institution per transaction). This way, cards couldn't be cloned.

    --
    Karma: -2147483648 (Mostly affected by integer overflow)
    1. Re:Challenge/response? by chevelleSS · · Score: 2, Informative

      I work for an ATM transaction processing company, and it would be really nice if that were possible.. but credit cards do NOT HAVE A MICRO-PROCESSOR (it cannot process a challenge response) in fact A credit card is only a magnetic number, all of the information is retrieved from your bank/Credit card company. The Grocery stores little card reader however does have a process, and Encryption of your card does start there..

      In order to process an ATM transaction, your credit card number is sent off from the ATM/Grocery store/wherever to your bank(with debit cards, your pen number goes with it).. In the case of an ATM, the number is encrypted before being sent over an unsecure line (like a telphone line, internet, or in some cases a wireless connection). When the transaction makes it to the Processor, the transaction is sent directly to the bank via a direct link to them, or routed to another processor who has the cheapest processing surcharge (Usually your transaction switches hands 3 times). The bank then verifies your information and your Pin number if applicable before sending the approval code with pertinent information (name, address, account balance) or denial code to your ATM/Grocery store. There are other situations that get very complicated such as Reversals (an ATM does not have the money to dispense, so your account is credited) partial reversals (the ATM dispenses twenty, but you asked for 200) and processing link failures (the transaction was approved but because of a link failure, the cardholders account does not know if the money was dispensed).

  27. Hong Kong has had this for a while by kramer2718 · · Score: 4, Interesting

    When I visited Hong Kong in 2001, I bought a subway pass with this technology.

    If you buy more than about $10 US of subway services, you have the option to get a smart card. My whole stay that card left my wallet only once (to return it for a refund). Othere than that when I used the subway, I would just set my wallet on top of the read. It was so conveneient.

    Even better, lots of vendors (such as convenience stores) let you pay using your subway credit.

    I guess there are more security concerns when using this with a real credit card, but it seems like it should have happened in this country sooner.

    --
    http://yetanotherpoliticalrant.blogspot.com
  28. I can see a new Amazon patent by DannyiMac · · Score: 5, Funny

    I can see Amazon patenting 0-click technology with this...

    --
    - Danny
  29. War Driving For Credit Card Numbers !! by Lew+Payne · · Score: 3, Interesting

    Leave it to those narrow-minded visionaries at VISA and Royal Phillips to come up with an even more insecure method of deploying consumer credit card information... via RF (wireless) technology.

    If you think credit card fraud is rampant now, wait until card thieves get hold of a portable RF reader and begin walking down crowded streets...

    Hey, that's fine with me. This gives me enough lead time to come out with a copper-lined wallet that prevents RF credit card theft. In fact, I'm racing to the patent office now!

  30. Stopping fraud? by chrome · · Score: 4, Insightful

    Reading some of the comments here about the security of these cards, and it makes me worry somewhat.

    I used to sysadmin for a shell account company, and we saw huge amounts of credit card fraud, mostly from kids looking to run bots on IRC, or just because they collected shell accounts.

    One thing I came away with from that experience was the definite feeling that Credit card companies don't seem to think it is in their interest to stop credit card fraud.

    After all, if the owner of a card is frauded, the bill goes on their card, and interest is accrued. If the owner of the card isn't diligent, its possible they might just automatically pay the card off, without even realise they have been a victim of card fraud.

    Certainly, the credit card companies don't seem to go after the fraudsters as much as they should. One of my friends on Dalnet used to regularly give the full details of people that she had discovered doing carding. One kid was so blatant, he put up a web page, with pictures of him holding up all the crap he had bought with stolen card numbers.

    He was 12, and his mother didn't care in the slightest he was stealing. And neither did the credit card companies. The police were interested though, but he didn't have much repercussions - just a couple of weeks in a counselling center for kids.

    Anyway, I digress.

    Proximity cards are a great ieda. It means I can just wave my wallet near the scanner to pay for an item.

    But, if this is not couple with some new form of identification currently not in use with credit cards (a pin number would suffice, or something biometric such as a thumb-print), then I fear that fraud will just increase.

    People will get a hold of the scanners, and set up their iPod to capture the card numbers of anyone in proximit to it, and just walk up behind people, snapping up numbers.

    Maybe I'm just getting paranoid.

    1. Re:Stopping fraud? by Jesus+IS+the+Devil · · Score: 2, Informative

      One thing to add...

      Another reason credit card companies don't care? They are not the ones to foot the bills when a chargeback is initiated. It's the merchant who is out of the entire purchase, some insane chargeback fee, and the lost product.

      Credit card companies will never care as long as the monetary loss due to fraud is LESS than the actual cost of pursuing the criminals.

      --

      eTrade SUCKS
  31. Octopus by ZarathustraThePolarB · · Score: 5, Informative
    In Hong Kong we've had a similar technology for several years now. It's called the Octopus card and virtually everyone in the city has one. It can be used for payment on nearly all public transport and in stores where people make small purchases.

    The EE Times article focuses on the technology is a bit light on details of what the card actually does, so I'm not sure if it is a stored-value card (like Octopus) or actually operates like a credit card. I would be surprised if it's the latter because of concerns about theft etc.

  32. Security by oreomitch · · Score: 2, Interesting

    Wouldn't the PKI scheme be used? That is to say that the card and card-reader share some key. I suppose that this would be just another variation on chip-card technology (EMV, Proton etc).

  33. For the naysayers... by SamMichaels · · Score: 5, Informative

    The place where I used to work had these key fobs which worked like that. I thought it'd be cool that we just had to walk next to the door and it'd open it.

    Not.

    Even when directly contacting the sensor with the key fob in my pocket it didn't activate it. It had to be held infront of the device, almost touching it.

    Whatever the range they say, I'm sure you're not going to be able to sniff out the RF signal by just sitting next to someone unless you have some expensive equipment.

  34. How am I suppose to impress people then? by mrklin · · Score: 2, Interesting
    With my American Express black Centurion card if I don't take it out?

    I kid. I don't have one and you can't "apply" for one either. Read more about it here and see it here.

  35. Jedi credit card trick. by tallackn · · Score: 2, Funny

    (waves hand) "You will sell me these goods." :)

  36. Japan has contactless credit cards already by gkanai · · Score: 3, Informative

    Japan has had contactless debit cards for quite some time, with technology developed by Sony. The Japan Railway East 'SUICA' cards are similar to the Octopus cards in Hong Kong.

    http://www.tcvb.or.jp/en/hot/sizzling/0112/sizzl in g_12c.html
    and
    http://edition.cnn.com/2003/WORLD /europe/02/18/biz .trav.smart.cards.ap/

    Also the EDY cards use similar technology and are embedded into credit cards so one card can be both a swipable credit card as well as a contact-less debit card.

    http://www.sony.net/Products/felica/contents04_0 1. html

  37. One use that springs immediately to mind.... by grahamlee · · Score: 4, Funny

    Waves AmEx These aren't the droids you're looking for...

    Obiwan was a bribe merchant!

  38. Re:How easy would it be to steal info from these? by pirodude · · Score: 4, Informative

    They do make contactless micro-processor smart cards. Schlumberger makes one, two, three, different versions.

    From their site:

    High-speed contactless operations are completed in less than 100 milliseconds and at distances of up to 10 cm from the reader. Security between different applications is ensured by two 48-bit diversified keys and specific access conditions per sector. Security is further reinforced by replay attack protection and a three-pass handshake, which manages the mutual authentication between the card and the reader. In addition, the Easyflex FastOS 2.0 fast anticollision algorithm allows more than one card to be processed by the reader at the same time.

    Easyflex FastOS 2.0 communicates on the 13.56 MHz carrier frequency in compliance with the current ISO 14443-Type A standard and implements the standard Mifare protocol, allowing it to be used with the vast majority of contactless card systems.

  39. Signature on credit cards? by millwall · · Score: 2, Insightful

    I've asked many people this but no one can give me a decent answer...

    What kind of security check is it to write your signature after using your credit card?

    I mean the signature is on the back of the card!

    It's like having the password to your computer written on a piece of paper stuck to your monitor...

  40. the Bush card by js7a · · Score: 3, Funny

    They should name these card after presidents Bush. You can run up a huge deficit without touching anything.

    1. Re:the Bush card by Eccles · · Score: 3, Insightful

      Hey, dummy. It is Democrats who want to spend, spend, spend. ...which is why the last two presidents to submit balanced budgets were Clinton and Johnson, and Carter's deficits were ~1/5 the average deficit Reagan submitted.

      Democrats want to spend, so do Republicans. The Democrats are just more honest about it.

      --
      Ooh, a sarcasm detector. Oh, that's a real useful invention.
    2. Re:the Bush card by Izrun · · Score: 2, Informative

      You do realize that by percentage points, the deficit is smaller than it has been in years, right? Let's say you make $1000 a month, and you spend 1100 bucks a month. You're running a 100 dollar deficit, which is 10%. Now, let's say you make $10,000 a month, and spend $10,200 a month. You're running a 200 dollar deficit, but it's only a 2% deficit. Which is worse? By your (and other liberals) math, the 100 dollar deficit is better. By my (conservative) math, the $200, 2% deficit is better. So I look at this as the deficit will be the smallest percent of our GDP since before Clinton, whereas you see it as the largest amount ever. You tell me which makes more sense (hint, my way, which follows logic).

      --
      -Izrun
  41. Useability problem by Frantactical+Fruke · · Score: 2

    The idea that just waving a card in the proximity of a reader will make you poorer makes people uncomfortable. Poor feedback.

    Our bus services recently switched to cards like that. People keep wondering, if the reader actually took the charge at all or charged them twice.
    The fact that the card itself has no display to show its balance and the reader a mere 20 character display increases the discomfort.

    If these cards aren't surrounded by proper interfaces, they will not get popular. ...um...

    Argh, I forgot the "Didn't cost anything: I paid with my Visa" effect that guides people into personal bankruptcy. They seem very comfortable with that. So forget I said anything.

  42. Isn't that how the SpeedPass works? by 192939495969798999 · · Score: 2, Insightful

    I think that's how SpeedPass works. It's really a faster way to buy things, but seems incredibly unsafe. If someone swipes that thing, you're done!

    --
    stuff |
  43. Who's talking about security? by JoseMonkey · · Score: 3, Interesting
    All of these threads about security seem off-topic to me. I don't think anyone really intended proximity cards as a way to improve security at all. Considering how dismal cc security is, it probably won't make it worse, either.

    I think the point is that proximity scanning is (slightly) easier than swiping -- especially since swiping isn't always straight-forward in my experience. (i.e., Clerk swipes card. Pause. Clerk swipes card. Pause. Clerk swipes card. Pause. Clerk enters number manually.) It might be nice to have the reading of a card number not be dependent on 1) the supple wrist of the user, 2) the condition of the card, 3) the speed and direction of the swiping motion . . . the list goes on and on.

    Also, the wear and tear on the cards might actually be reduced enough to make them last more than a few months . . .

  44. Tips for Mitigating Credit Card Risks by Col.+Panic · · Score: 2, Informative

    Receipts carelessly tossed in a garbage can outside of certain stores (yes, many of them do print your full name, card number and exp. Date)

    Shred receipts you don't need and keep secure those you do.

    Hacking insecure online servers (many have 1000s of cards in plain text or weakly encrypted)

    If you are going to purchase online via credit card, never allow the website to store the data "for your convenience" because then it is in their database. The site should have to ask for your cc# for each and every transaction. If they don't have the option not to store your card info, don't shop there and let them know why.

    Consider getting a single, low limit card that you use exclusively for online purchases, particularly one that advertises online purchase protection.

    Check you statement monthly or more often (if online statements are available.)

    Grab your mail

    This is a federal offense, but anyway. Don't forget your mail carrier at Christmas, Kwanza, Hanukah, whatever.

    Look in your recycling box

    Shred, shred, shred.

    Look at your card over your shoulder

    Be aware of your surroundings.

    Hidden cameras, crooked cashiers/waiters etc

    see: "Check your statement monthly" above.

    Set up a fake online store selling a few products very cheaply.

    Set up a cheap porn site. (ala the Eros Island scam)

    Discover USENET pr0n, which is free. You don't mean you actually *pay* for pr0n do you?

  45. First they better check out Cypak by TheLoneGundam · · Score: 2, Interesting

    I think they better first check out the so-called "Smarter Card" from Cypak a Swedish firm that has a card with embedded CPU and RF, and a keypad built onto the card which requires the user to enter a PIN to validate use of the card. Seems to me that Cypak already has most of the relevant technology.

  46. Pros & Cons by Anonym1ty · · Score: 2, Insightful

    Pro: My card won't wear out before it expires 6 years from now

    Con: Now I can have my number stolen without comming into physical contact with the theif
    --This could be a pro if you consider it could make getting robbed a whole lot safer .

    --
    See the Pictures of the Flood of '08
  47. The Final Phase of Window Shopping ... by Anonymous Coward · · Score: 2, Funny

    'cuse me sir, you just bought this purple-metallic minivan with golden rims ... where would you like us to ship it?

  48. Increased Credit Card Theft? by SharkPork · · Score: 2, Interesting

    So, someone gets a dummy card that looks real and holds that in their hand. but the stolen card is up your sleeve, and activates the electronics. Visual verification by the cashier? sure! Of course the signature looks right, you wrote it! But it seems like it might be a halfway decent technology if they can figure out how to avoid abuse like that. ah well, just my 857,345,246.4 rubles.

    --
    If you can read this, you are most likely close enough.
  49. Did anyone RTFA? by jhines0042 · · Score: 2, Insightful

    Looks to me like just a speedier way to suck money out of your bank account and charge you for the service to boot!

    I don't know about everyone else but I go running scared when I see things like (paraphrased) "...standard method of allowing consumers to purchase content in their home..."

    I can see it now.... "please wave your contactless credit card to watch this channel"....

    --
    42 - So long and thanks for all the fish.
  50. Stealing Proximity Cards by JWSmythe · · Score: 2, Informative

    I read a few articles on "stealing" proximity card data. It's aparently not very hard..

    One proximity card that I use requires almost physical contact to the reader, which is appropriate for a doorway.. But another card I use (same building, same card type) to open the garage gate reads the card within about a foot of the reader. I roll my car slowly by, casually holding the card out, and it reads with no contact.

    With the appropriate equipment, you can read data from just about anyone's card at a distance. How close do you have to be? People get kinda close in elevators, or you can just be polite, and be holding an outside door for them while they walk by your briefcase/laptop bag/purse. For that matter, I guess your reader could be in the brown paper bag that appears to hold your lunch.

    H2K2 had a lecture on it. Here's the lecture description. in July of 2002

    "Proximity Cards: How Secure Are They?

    Sunday, 6 pm
    Area "B"

    They're used everywhere but they could be making you even more vulnerable to privacy invasion. Delchi has been working with proximity based card systems for two years and has developed a method of casually extracting data from proximity cards in a public environment. Riding in an elevator, subway, or just walking down the hall, a person can bump into you, say "excuse me," and walk away with the decoded information from the proximity card in your pocket. It could then be possible to build a device that can capture and replay these snippets of information on demand or to even brute force a proximity card system. This talk will focus on the vulnerabilities of the systems and show a low power working prototype. Alternatives will be discussed, as well as other vulnerable aspects of proximity based building and computer access systems."

    I've read some design information on it also, but can't seem to find the links right now. I don't know what the options are for protection of proximity cards.. Keep them in a foil pouch?

    --
    Serious? Seriousness is well above my pay grade.
  51. First Sploit! by blair1q · · Score: 2, Interesting

    So then I walked through the mall with my card scanner on and picked up about 15 valid numbers from people I passed.

    Wanna go shopping?